TableClientSideEncryption

class aws_cdk.aws_glue_alpha.TableClientSideEncryption(*args: Any, **kwargs)

Bases: object

(experimental) Client-side encryption for an S3Table’s data.

Independent of the bucket’s server-side encryption and of who owns the bucket: the data is encrypted by the client before it is written to S3. When set, the grant* methods also grant the relevant KMS permissions on the key.

Stability:

experimental

ExampleMetadata:

infused

Example:

# my_database: glue.Database

# KMS key is created automatically
glue.S3Table(self, "MyTable",
    client_side_encryption=glue.TableClientSideEncryption.kms(),
    # ...
    database=my_database,
    columns=[glue.Column(
        name="col1",
        type=glue.Schema.STRING
    )],
    data_format=glue.DataFormat.JSON
)

# with an explicit KMS key
glue.S3Table(self, "MyTable",
    client_side_encryption=glue.TableClientSideEncryption.kms(kms.Key(self, "MyKey")),
    # ...
    database=my_database,
    columns=[glue.Column(
        name="col1",
        type=glue.Schema.STRING
    )],
    data_format=glue.DataFormat.JSON
)

Static Methods

classmethod kms(key=None)

(experimental) Client-side encryption (CSE-KMS) with an AWS KMS key managed by the account owner.

Parameters:

key (Optional[IKey]) – the KMS key used to encrypt the data. A key is created if one is not provided.

Stability:

experimental

Return type:

TableClientSideEncryption